Troubleshooting Dependabot on GitHub Actions

Restrictions when Dependabot triggers events

Dependabot is able to trigger GitHub Actions workflows on its pull requests and comments; however, certain events are treated differently.

For workflows initiated by Dependabot (github.actor == 'dependabot[bot]') using the pull_request, pull_request_review, pull_request_review_comment, push, create, deployment, and deployment_status events, these restrictions apply:

GITHUB_TOKEN has read-only permissions by default.
Secrets are populated from Dependabot secrets. GitHub Actions secrets are not available.

For workflows initiated by Dependabot (github.actor == 'dependabot[bot]') using the pull_request_target event, if the base ref of the pull request was created by Dependabot (github.event.pull_request.user.login == 'dependabot[bot]'), the GITHUB_TOKEN will be read-only and secrets are not available.

These restrictions apply even if the workflow is re-run by a different actor.

For more information, see Keeping your GitHub Actions and workflows secure: Preventing pwn requests.

Troubleshooting failures when Dependabot triggers existing workflows

GitHub Enterprise Server 인스턴스에서 Dependabot 업데이트를 설정한 후 Dependabot 이벤트로 기존 워크플로가 트리거될 때 오류가 표시될 수 있습니다.

기본적으로 Dependabot의 push, pull_request, pull_request_review 또는 pull_request_review_comment 이벤트에서 트리거된 GitHub Actions 워크플로 실행은 리포지토리 포크에서 열린 것처럼 처리됩니다. 이 경우 다른 작업자에서 트리거된 워크플로와 달리, 읽기 전용 GITHUB_TOKEN을 받게 되며 일반적으로 사용할 수 있는 비밀에 액세스할 수 없습니다. 따라서 리포지토리에 쓰려는 워크플로가 Dependabot에서 트리거된 경우 실패합니다.

문제를 해결하는 방법에는 다음 세 가지가 있습니다.

if: github.actor != 'dependabot[bot]'과 같은 식을 사용하여 더 이상 Dependabot에서 트리거되지 않도록 워크플로를 업데이트할 수 있습니다. 자세한 내용은 "워크플로 및 작업에서 식 평가"을(를) 참조하세요.
pull_request_target이 포함되어 이 제한 사항이 없는 2단계 프로세스를 사용하도록 워크플로를 수정할 수 있습니다. 자세한 내용은 "GitHub Actions를 통한 Dependabot 자동화"을(를) 참조하세요.
비밀에 대한 Dependabot 액세스로 트리거되는 워크플로를 제공하고 permissions 용어가 GITHUB_TOKEN의 기본 범위를 늘리도록 허용할 수 있습니다.

Some troubleshooting advice is provided in this article. You can also see GitHub Actions에 대한 워크플로 구문.

Accessing secrets

When a Dependabot event triggers a workflow, the only secrets available to the workflow are Dependabot secrets. GitHub Actions secrets are not available. You must therefore store any secrets that are used by a workflow triggered by Dependabot events as Dependabot secrets. For more information, see Dependabot에 대한 개인 레지스트리 액세스 구성.

Dependabot secrets are added to the secrets context and referenced using exactly the same syntax as secrets for GitHub Actions. For more information, see GitHub Actions에서 비밀 사용.

If you have a workflow that will be triggered by Dependabot and also by other actors, the simplest solution is to store the token with the permissions required in an action and in a Dependabot secret with identical names. Then the workflow can include a single call to these secrets. If the secret for Dependabot has a different name, use conditions to specify the correct secrets for different actors to use.

For examples that use conditions, see GitHub Actions를 통한 Dependabot 자동화.

To access a private container registry on AWS with a user name and password, a workflow must include a secret for username and password.

In this example, when Dependabot triggers the workflow, the Dependabot secrets with the names READONLY_AWS_ACCESS_KEY_ID and READONLY_AWS_ACCESS_KEY are used. If another actor triggers the workflow, the actions secrets with those names are used.

YAML

name: CI
on:
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Login to private container registry for dependencies
        uses: docker/login-action@3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c
        with:
          registry: https://1234567890.dkr.ecr.us-east-1.amazonaws.com
          username: ${{ secrets.READONLY_AWS_ACCESS_KEY_ID }}
          password: ${{ secrets.READONLY_AWS_ACCESS_KEY }}

      - name: Build the Docker image
        run: docker build . --file Dockerfile --tag my-image-name:$(date +%s)

name: CI
on:
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Login to private container registry for dependencies
        uses: docker/login-action@3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c
        with:
          registry: https://1234567890.dkr.ecr.us-east-1.amazonaws.com
          username: ${{ secrets.READONLY_AWS_ACCESS_KEY_ID }}
          password: ${{ secrets.READONLY_AWS_ACCESS_KEY }}

      - name: Build the Docker image
        run: docker build . --file Dockerfile --tag my-image-name:$(date +%s)

Changing `GITHUB_TOKEN` permissions

By default, GitHub Actions workflows triggered by Dependabot get a GITHUB_TOKEN with read-only permissions. You can use the permissions key in your workflow to increase the access for the token:

YAML

name: CI
on: pull_request

# Set the access for individual scopes, or use permissions: write-all
permissions:
  pull-requests: write
  issues: write
  repository-projects: write
  ...

jobs:
  ...

name: CI
on: pull_request

# Set the access for individual scopes, or use permissions: write-all
permissions:
  pull-requests: write
  issues: write
  repository-projects: write
  ...

jobs:
  ...

For more information, see 자동 토큰 인증.

Manually re-running a workflow

When you manually re-run a Dependabot workflow, it will run with the same privileges as before even if the user who initiated the rerun has different privileges. For more information, see 워크플로 및 작업 다시 실행.